Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2023 01:45
Behavioral task
behavioral1
Sample
90c5baa1030eb91bb5f870eb75e48fe3187d41c938527695ae59bdc6fb6bd3ba.exe
Resource
win7-20230220-en
General
-
Target
90c5baa1030eb91bb5f870eb75e48fe3187d41c938527695ae59bdc6fb6bd3ba.exe
-
Size
348KB
-
MD5
a84e026ecca48ed97df640bb5b68e980
-
SHA1
c7a8291fa7b7fd6ed7c633e95b6c48d646acfc6d
-
SHA256
90c5baa1030eb91bb5f870eb75e48fe3187d41c938527695ae59bdc6fb6bd3ba
-
SHA512
57c92c32df21dfc9346446ee4146da01e2fd52101f5fab1f24364addbc8bb3846b9f2fecc7b5f2c8fee5301be8b0af833a9d6b43f5ae73d55201167be4ef61c0
-
SSDEEP
6144:P7qQ4i1FFiEKrmVxmg1TnE0DaGbdRly/9LxcGBFGbVzS:jpli8xx1Q9tLxdBERzS
Malware Config
Extracted
quasar
1.3.0.0
Office04
cryptersandtools.ddns.com.br:5552
QSR_MUTEX_PV7LCoiUmiwD1RBPCq
-
encryption_key
Vw2ej5yeMh01Kv7liiDf
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Processes:
flow ioc 14 ip-api.com 18 api.ipify.org -
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/696-133-0x0000000000950000-0x00000000009AE000-memory.dmp family_quasar -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 ip-api.com 18 api.ipify.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
90c5baa1030eb91bb5f870eb75e48fe3187d41c938527695ae59bdc6fb6bd3ba.exedescription pid process Token: SeDebugPrivilege 696 90c5baa1030eb91bb5f870eb75e48fe3187d41c938527695ae59bdc6fb6bd3ba.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/696-133-0x0000000000950000-0x00000000009AE000-memory.dmpFilesize
376KB
-
memory/696-134-0x00000000059D0000-0x0000000005F74000-memory.dmpFilesize
5.6MB
-
memory/696-135-0x0000000005420000-0x00000000054B2000-memory.dmpFilesize
584KB
-
memory/696-136-0x00000000053D0000-0x00000000053E0000-memory.dmpFilesize
64KB
-
memory/696-137-0x00000000057C0000-0x0000000005826000-memory.dmpFilesize
408KB
-
memory/696-138-0x00000000059B0000-0x00000000059C2000-memory.dmpFilesize
72KB
-
memory/696-139-0x00000000053D0000-0x00000000053E0000-memory.dmpFilesize
64KB
-
memory/696-140-0x00000000067B0000-0x00000000067BA000-memory.dmpFilesize
40KB